JP2018063518A5 - - Google Patents

Description

Management server, management method and program thereof

  The present invention relates to a management server for managing a computer system.

  When a problem occurs in a computer system, there is a management system that analyzes the influence on an application program running on the computer system (see, for example, Patent Document 1). The failure cause extraction device described in Patent Document 1 includes a storage unit and a correlation breakdown propagation detection unit. Here, the storage unit is a correlation that performs conversion from the performance value of the input type to the performance value of the output type generated based on the time series of performance information including performance values of multiple types in the system. Store a correlation model that contains one or more functions. The correlation destruction propagation detection unit can be directly or indirectly converted from the performance value of one type of base point, and is used for conversion to another type of performance value that does not become an input of the correlation function Based on the number of base point propagation functions that are functions, calculate the degree of influence that the base point performance value has on the system.

WO 11/099341

  Since the application program includes various processes, the administrator of the application program would like to identify the process that has an influence and the reason for it and take measures promptly if a problem occurs on the computer system. However, in Patent Document 1 described above, when a problem occurs on the computer system, the influence of the processing is generated because the presence or absence of the influence is determined from the level of the correlation between the performance on an application basis and the operation data of the computer system. It is difficult to identify the reason.

  The following is a representative example of the invention disclosed in the present application. That is, a management server that manages a computer system that executes an application program, comprising: a processor that executes the program; and a storage device that stores the program, wherein the processor determines the characteristics of processing included in the application program. The correlation between the process included in the application program and the component of the computer system is identified by extracting and analyzing the correlation between the characteristic of the process and the component of the computer system, and the processor identifies the correlation between the component and the process of the computer system. Based on the correlation, the relationship between the operation status of the computer system and the characteristic of the process included in the application program is specified.

  According to the representative embodiment of the present invention, it is possible to identify the affected process in the application program. Problems, configurations, and effects other than those described above will be clarified by the description of the following embodiments.

It is a figure which shows the effect of the influence analysis process in the computer system concerning 1st embodiment. It is a block diagram showing an example of composition of a system in a 1st example. It is a figure which shows an example of the processing characteristic in a 1st Example. It is a figure which shows an example of the correlation data in a 1st Example. It is a figure which shows an example of the structure information of the computer system in a 1st Example. It is a figure which shows an example of the structure information of the application in a 1st Example. It is a flowchart of the correlation learning process in a 1st Example. It is a flowchart of the influence analysis process in a 1st Example. It is a figure which shows the outline | summary of the specific process of the related application in a 1st Example. It is a figure which shows the outline | summary of the influence analysis process for every process in a 1st Example. It is a figure which shows the example of the screen which the management server output in a 1st Example outputs. It is a block diagram which shows the structural example of the system in a 2nd Example. It is a flowchart of a cause analysis process in the second embodiment.

  In the following description, the information of the present embodiment will be described in terms of expressions such as "aaa table", "aaa list", "aaaDB (Database)", (aaa is any character string), etc. The information does not have to be stored, and may be represented by other than a data structure such as a table, a list, a DB, and a queue. Therefore, the “aaa table”, the “aaa list”, the “aaa DB”, and the like may be referred to as “aaa information” to indicate that they do not depend on the data structure.

  In addition, when describing the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID (IDentification)” are used, but these can be mutually replaced. is there.

  Further, in the following description, the term "program" may be used as the subject, but since the program performs processing defined by being executed by the processor using the memory and the communication port (communication control device), the processor The description may be based on the subject of Further, the processing disclosed with the program as the subject may be processing performed by a computer such as a management server or an information processing apparatus. Also, part or all of the program may be realized by dedicated hardware.

  In addition, various programs may be installed in each computer by a program distribution server or a storage medium readable by a computer. In this case, the program distribution server includes a processor and a storage resource, and the storage resource further stores a distribution program and a program to be distributed. Then, when the processor executes the distribution program, the processor of the program distribution server distributes the distribution target program to another computer.

  Also, the computer has an input / output device. As an example of the input / output device, a display, a keyboard, a pointer device, a tablet terminal, and a smartphone can be considered, but other devices may be used. As an alternative to the input / output device, a serial interface or Ethernet interface is used as the input / output device, a display computer having a display, keyboard or pointer device is connected to the interface, and display information is transmitted to the display computer, By receiving the information for input from the display computer, display may be performed by the display computer, or input and display in the input / output device may be substituted by receiving input. Hereinafter, the interface may be described as I / F.

  Also, the computer has a communication I / F. As an example of communication I / F, LAN (Local Area Network) connection terminal, SAN (Storage Area Network) connection terminal, and wireless communication connection device can be considered, but devices other than these may be used. Good.

Hereinafter, a set of one or more computers that manage the information processing system and display the display information of this embodiment may be called a management system. When the management computer (hereinafter, management server ) displays the display information, the management server is a management system, and a combination of the management server and the display computer is also a management system. In addition, in order to speed up the management processing and increase reliability, processing equivalent to that of the management server may be realized by a plurality of computers, and in this case, the plurality of computers (for display when the display computer performs display) The computer is also a management system.

<Example of problem solving process>
FIG. 1 is a diagram showing the effect of the impact analysis process in the computer system according to the first embodiment of the present invention.

  The computer system 1 is an example of a computer system to which the present embodiment is not applied. The computer system 1 is operated on a managed server device 203, a managed storage device 204, an application program 250 operated on the server device 203, a management server 201 for managing each device, and a managed device Include middleware applications and applications.

  The management server 201 detects the occurrence of a problem in the managed storage apparatus 204, and the application that is affected is the application 2 and the application 3 by the correlation analysis between the application performance and the operation status of the managed IT resource. Calculate However, it can not be specified which process of the application 2 and the application 3 is affected.

  In addition, with regard to a new application, it is not possible to determine whether or not it is affected by a problem that occurs in the storage device 204 that is an IT resource, because learning data regarding the correlation between application performance and IT resource operating status is insufficient. Here, the problem in the computer system 1 is the occurrence of an abnormality or a sign of an abnormality. Application administrators want to deal with problems in IT resources before they affect the users of the application, but generally, applications provide services that include multiple processes, and the same IT resource problems Depending on the process, the presence or absence of the influence is different. For example, if the disk IO is a bottleneck, processing that generates a large amount of disk access that searches long-term trend data is affected, but processing that does not generate a disk access such as in-memory simulation does not. I do not receive it.

  Therefore, in the computer system 1, even if the presence or absence of the influence is known on an application-by-application basis, the processing that exerts the influence is not known, the necessary response can not be determined, and it takes time to take effective measures. In addition, for new applications, correlation analysis can not analyze the presence or absence or extent of the impact because the learning data on correlation is insufficient.

  The computer system 2 is an example of a computer system to which the present embodiment is applied. In the conventional computer system 1, the influence is analyzed by the correlation between the application performance and the operating state of the IT resource, but in the computer system 2, the processing characteristic is extracted from the application, and the influence is analyzed by the correlation between the processing characteristic and the IT resource. In this way, when a problem occurs in an IT resource, it is possible to analyze the presence or absence of an influence on the processing unit of the application. Also, by associating the processing included in the application with the processing characteristics, even new applications can analyze the impact using existing correlations.

  As described above, the method of the present embodiment has the effect of being able to determine the presence or absence of an influence in processing units in the influence analysis processing by using the characteristics of the processing of the application.

  Note that the system configuration illustrated in FIG. 1 omits part of the detailed system configuration described in FIG.

Example 1
FIG. 2 is a block diagram showing a configuration example of a system in the first embodiment of the present invention.

  The system of the first embodiment includes a management server 201 and a computer system managed by the management server 201. The computer system managed by the management server 201 is configured by mutually connecting a server device 203, a storage device 204, a network device 205, and a cloud service 206 via a network 207 or a SAN (Storage Area Network). Ru.

  For example, although each component included in the system such as the management server 201, the processor 211 in the management server 201, and the main storage device 212 is illustrated only one each, a plurality of each may be provided. .

  The management server 201 is a computer having a processor 211, a main storage device 212, an auxiliary storage device 213, and a communication interface.

  The processor 211 executes a program stored in the main storage device 212. Specifically, the processor 211 executes a correlation learning processing program 220, an influence analysis processing program 221, and an event detection program 222. It should be noted that part or all of the correlation learning processing program 220, the impact analysis processing program 221, and the event detection program 222 are executed by the processor 211 instead of being executed by the processor 211, for example, hardware such as an integrated circuit (field-programmable gate array). It may be realized by hardware.

  The main storage device 212 includes a ROM, which is a non-volatile storage device, and a RAM, which is a volatile storage device. The ROM stores an immutable program (for example, BIOS). The RAM is a high-speed and volatile storage device such as a dynamic random access memory (DRAM), and temporarily stores a program executed by the processor 211 and data used when the program is executed. Specifically, the main storage device 212 stores a correlation learning processing program 220, an influence analysis processing program 221, an event detection program 222, and a countermeasure generation program 224.

The auxiliary storage device 213 is constituted by, for example, a large-capacity and non-volatile storage device such as a magnetic storage device (HDD) or a flash memory (SSD), and stores data used when executing a program. The auxiliary storage device 213 may be an external storage device connected to the management server 201 via an I / F (not shown) to an external device or the communication interface 216, such as the storage device 204. Further, the main storage device 212 and the auxiliary storage device 213 may be the same device.

Specifically, the auxiliary storage device 213 stores processing characteristics 231, correlation data 232, configuration information 233, operation data 234, and countermeasure data 235. The processing characteristics 231, the correlation data 232, the configuration information 233, and the operation data 234 may be stored in different auxiliary storage devices 213, or a part or all of them may be stored in the main storage device 212. It may be stored in the main storage device 252 or the auxiliary storage device 254 on another server device 203 connected via the network 207, or may be auxiliary to another storage device 204 connected via the network 207. It may be stored in the storage device 263.

  The processing characteristic 231 is information on the feature amount of the processing such as the difference in the type of processing, the amount of data to be processed, the type of data to be handled, etc. It may be a type of processing such as whether the processing is update processing or deletion processing. Details of the processing characteristic 231 will be described later with reference to FIG.

  The correlation data 232 is information on the mutual relationship between monitoring information of the computer system monitored by the management server. For example, the correlation data 232 may be information on the correlation between the response time of the application program and the utilization of the processor of the server device 203. Details of the correlation data 232 will be described later with reference to FIG.

Also, the correlation data 232 may include the correlation between the operation data of the management server 201. For example, the correlation data 232 has a relationship that the response time of the cloud service 206 is slow when the response time of the application program 250 of the server device 203 is slow, or when the IOPS of the logical volume 260 of the storage device 204 is high. The information may be information indicating that the execution time of the job is slow or that the response time of the application program is slow when the number of logs per unit time of the application program of the server apparatus 203 is large. The correlation data 232 may be correlation between data used in a computer system managed by the management server 201. This correlation may be in the form of a correlation equation, or may be a qualitative value such as high or low degree of correlation.

The configuration information 233 is information on the connection relationship between the managed devices, and the relationship between the managed application program and the managed devices. Details of the configuration information 233 will be described later with reference to FIGS. 5 and 6.

Operating data 234, and device group management server 201 manages, in a working data of a program to be executed in the device. For example, it may be an operation log output by the application program 250, a configuration change log of a virtual machine, or time-series IOPS performance data of the logical volume 260 of the storage apparatus 204.

  The countermeasure data 235 is data of a countermeasure plan displayed together with the analysis result of the influence range.

  In addition, the auxiliary storage device 213 may store a program executed by the processor 211. That is, the program is read from the auxiliary storage device 213, loaded into the main storage device 212, and executed by the processor 211.

  The communication interface 216 is a network interface device (NIC) that controls communication with other devices (such as the operation terminal 202 and the server device 203) connected to the network 207 according to a predetermined protocol.

  The management server 201 may have an input interface and an output interface. The input interface is an interface to which a keyboard, a mouse and the like are connected and which receives an input from an administrator. The output interface is an interface to which a display device, a printer, and the like are connected, and which outputs the status of the management server 201 and the execution result of the program in a format that can be viewed by the administrator.

  The program executed by the processor 211 is provided to the management server 201 via removable media (CD-ROM, flash memory, etc.) or a network, and is stored in a non-volatile auxiliary storage device 213 which is a non-temporary storage medium. For this reason, the management server 201 may have an interface for reading data from removable media.

  The management server 201 is a computer system configured physically on one computer or on a plurality of logically or physically configured computers, and is a virtual system constructed on a plurality of physical computer resources. It may operate on a computer. Also, programs executed on the management server 201 may operate in separate threads on the same computer.

Also, the operation terminal 202 may be connected to the management server 201. The operation terminal 202 is a computer that operates the management server 201. The operation terminal 202 has an input / output device 241. The input / output device 241 is a device (for example, a keyboard, a mouse, a display device, a printer, etc.) that inputs and outputs data according to an operation of the administrator. The data input to the input / output device 241 is transmitted to the management server 201 via the network 207. The output device 242 is a display device, a printer, or the like that outputs data from the management server 201.

  The server device 203 is a computer monitored by the management server 201 and executes an application program. The server device 203 includes an application program 250, a processor 251, a main storage device 252, and an auxiliary storage device 253.

  The application program 250 may be, for example, an application that provides business services such as a material ordering application or an electronic commerce application, an application (such as a database) that is internally used by an application that provides business services, and an application that provides virtual machines ( Includes various application programs such as Hypervisor and OS that provides container service. The server device 203 may execute an application program, and may not necessarily be in the form of a physical server device, such as a virtual computer or a container. Therefore, the server device 203 may not necessarily include the physical processor 251, the main storage device 252, and the auxiliary storage device 253, or may include components (not shown).

  The storage device 204 is a device managed by the management server 201, and provides a program operating on the server 203 and a storage area used by a program operating on the management server 201. The storage device 204 has a logical volume 260, a communication I / F 261, an IO processing unit 262, and an auxiliary storage device 263.

  The auxiliary storage device 263 may provide a plurality of non-volatile storage devices as a logical volume 260, for example, with redundancy by means of RAID (Redundant Arrays of Inexpensive Disks) or the like. Also, a plurality of RAID-set auxiliary storage devices 263 may be virtually controlled as one auxiliary storage device 263. The logical volume 260 is configured by the storage area of the auxiliary storage device 263. Data to the logical volume 260 is input / output via the communication I / F 261, and the IO processing unit 262 controls input / output of data. The storage device 204 may include components not shown, such as a main storage device.

  The network device 205 is a device managed by the management server 201, and has a plurality of communication I / Fs 270. The network device 205 connects a plurality of devices in a computer system to transfer data. For example, the network device 205 connects the plurality of server devices 203, connects the plurality of storage devices 204, and connects the server device 203 and the storage device 204. As a typical network device, for example, there are an IP (Internet Protocol) switch and an FC (Fiber Channel) switch, but the network device 205 may be another type of device.

  The cloud service 206 is a virtual device managed by the management server 201, and is a computer that provides a service via the Internet. Typical examples of the cloud service 206 include the functions of the server apparatus 203 provided via the Internet and the functions of the storage apparatus 204 provided via the Internet, but may be a function for providing other services. .

  The event detection program 222 may be present not on the management server 201 but on a computer system managed by the management server 201.

  FIG. 3 is a view showing an example of the processing characteristic 231 in the first embodiment.

  The processing characteristic 231 is information in which the feature quantities of the processing of the application program are classified, for example, held in the form of a table, and is prepared in advance manually or by another program. Hereinafter, although there are cases where the processing characteristics and the feature quantities of processing are expressed in two ways, they mean the same information. The processing characteristic 231 includes an ID field 301, a processing content field 302, a data amount field 303, and a data storage format field 304.

  The ID field 301 stores identification information that uniquely identifies the classification of processing characteristics. The processing content field 302, the data amount field 303, and the data storage format field 304 store feature amounts of processing by the application. Processing features are extracted from the application. The processing characteristic 231 may not include part of the illustrated fields, or may include other fields not shown. In addition, fields included in the processing characteristic 231 may be divided and stored in a plurality of tables.

  FIG. 4 is a view showing an example of the correlation data 232. As shown in FIG.

The correlation data 232 is held, for example, in the form of a table, of correlation information between the performance of the application classified by the processing characteristic and the operation data of the computer system, and is prepared in advance manually or by another program. The correlation data 232 includes an ID field 401, an SV CPU field 402, an SV Mem field 403, and an ST LU field 404.

The ID field 401 is identification information that uniquely identifies the classification of the processing characteristic 231, and stores a value common to the ID field 301 of the processing characteristic 231. The SV CPU field 402, the SV Mem field 403, and the ST LU field 404 are information related to monitoring items of operation data of the computer system monitored by the management server 201. The correlation data 232 may not include some of the illustrated fields, or may include other fields (not shown). Also, these fields may be divided and stored in a plurality of tables.

The SV CPU field 402 stores correlation information between operation data of the processor 211 of the server device 203 and application performance of the processing characteristic 231 . Further, the SV Mem field 403 stores correlation information between the operation data of the main storage device 212 of the server device 203 and the application performance of the processing characteristic 231 , and the ST LU field 404 shows the operation data of the logical volume 260 of the storage device 204. And correlation information of the application performance of the processing characteristic 231 is stored. Here, for simplification, the correlation data is stored as a character string indicating a level such as high or low, but for example, the correlation may be held in the form of a calculation formula such as a correlation formula, or the correlation degree may be clustered The correlation may be held in the form of a class calculated by classification in the process of (1), or the correlation may be held in another format.

Further, although there are a plurality of monitoring items such as response time and IOPS (the number of input / output processing requests per unit time) in the operation data of the logical volume 260, for example, this is omitted for simplification in this embodiment. To write. The correlation data with the processing characteristics may be held for each monitoring item of the component of the computer system.

Next, an example of the configuration information 233 described above will be described using FIGS. 5 and 6. The configuration information 233 includes the configuration information table 500 of the computer system shown in FIG. 5 and the configuration information table 600 of the application shown in FIG.

  FIG. 5 is a diagram showing an example of the configuration information table 500 of the computer system.

  The configuration information table 500 of the computer system holds logical or physical connection information of the components of the computer system managed by the management server 201, for example, in the form of a table, and is prepared in advance manually or by other programs. Be done. The computer system configuration information table 500 includes an application field 501, a server field 502, a processor field 503, a storage field 504, and a logical volume field 505.

The application field 501 stores identification information for uniquely identifying an application. The server field 502 stores identification information for specifying the server apparatus 203 on which the application is operating . The processor field 503 stores identification information for identifying the processor 211 that is executing an application. The storage field 504 stores identification information for specifying the storage device 204 that stores data used by the application. The logical volume field 505 stores identification information for specifying the logical volume 260 storing data used by the application.

The configuration information table 500 of the computer system may not include part of the illustrated fields, or may include other fields not shown. Also, these fields may be divided and stored in a plurality of tables. As another field (not shown), for example, service version information regarding the cloud service 206 or information of the API specification version may be recorded, or the type of storage medium of the auxiliary storage device 263 of the storage device 204 (HDD (Hard Information of whether the disk drive is a disk drive), a solid state disk (SSD), or the like, or the performance (such as an operating frequency) of the processor 251 of the server apparatus 203 may be recorded. Configuration information table 500 of the computer system, components of the computer system management server 201 manages, for example, an application program 250 of the server device 203, such as a logical volume 260 of the storage device 204, if the subject of acquiring operating data, It is desirable that data of all components be recorded.

  FIG. 6 is a diagram showing an example of the configuration information table 600 of the application.

The configuration information table 600 of the application holds, for example, in the form of a table, information on the correspondence between processing executed in the application managed by the management server 201 and processing characteristics, and is prepared in advance manually or by another application program. Ru. The application configuration information table 600 includes an ID field 601, an application field 602, a processing field 603, and a processing characteristic field 604. The ID field 601 stores identification information that uniquely identifies a process to be performed in the application. The application field 602 stores identification information specifying which application the process is included in. The processing field 603 stores a header that allows a person to recognize the purpose for which the processing is to be performed. The processing characteristic field 604 stores processing characteristics. Multiple processing characteristics may correspond to one processing. The application configuration information table 600 may not include part of the illustrated fields, or may include other fields not shown. Also, these fields may be divided and stored in a plurality of tables.

Next, the correlation learning process performed by the management server 201 will be described. The correlation learning process is a process implemented by the processor 211 of the management server 201 executing the correlation learning process program 220.

  FIG. 7 is a flowchart illustrating an example of a procedure of correlation learning processing executed by the management server 201.

First, a trigger when the correlation learning process is performed will be described. The correlation learning process may be performed according to an instruction from the administrator. The administrator's instruction is input from an input / output device 241 of the operation terminal 202 or an unshown input / output device of the management server 201. Further, the management server 201 may execute the correlation learning process in response to the output result of another program. Also, the correlation learning process may be performed at a predetermined timing. The predetermined timing may be periodic (for example, every hour) or may be triggered by the arrival of a time designated by the scheduler. Further, the correlation learning process may be executed when the management server 201 detects a configuration change (for example, update of an application program, migration of a virtual machine, etc.) of a managed computer system. In addition, the management server 201 changes the behavior of the managed computer system (for example, the change in the tendency of access from the user to the application, the change in the amount of accessed data, the operating data of the managed computer system exceeds the threshold value, The correlation learning process may be executed when operation data of the managed computer system detects a specific pattern, etc.). Further, the correlation learning process may be executed when it is detected that the administrator has completed the execution of the failure countermeasure. Further, the correlation learning process may be executed when the difference between the predicted value calculated based on the correlation data stored in the management server 201 and the actual measurement value is detected. An event that triggers these correlation learning processes may be detected by the event detection program 222.

  As shown in FIG. 7, the management server 201 executes processing characteristic extraction processing (step S701), configuration information update processing (step S702), and correlation analysis processing (step S703). The correlation learning process flow 700 may include other process steps not shown. In addition, each processing step may be performed one or more times before the influence analysis processing 221 is performed, and when the correlation learning processing flow 700 is performed after the second time, a part of the processing steps illustrated is performed. It does not have to be done. Further, in the correlation learning process flow 700, the order of executing the illustrated process steps may be different.

In processing characteristic extraction processing (step S 701), the management server 201 extracts feature amounts of processing executed by the application, and registers the extracted feature amounts of processing in the processing characteristics 231. For example, the execution time of the process is acquired from the operation data of the application, and the acquired execution time is clustered by another application to extract the feature value. Alternatively, the feature amount may be extracted from the access log to the database by classifying whether the process is a registration process, a read process, an update process, or a delete process. Also, the amount of data to be accessed may be compared from the operation data of the application to extract the feature amount. Alternatively, the number of application users may be acquired from the login history of the application of the user to extract the feature value. These feature quantity extraction processes may be performed manually. If a new feature of the process can not be extracted by the process of extracting the process characteristic (step S701), the feature of the process may not be registered in the process characteristic 231. A data record may be newly added by execution of the process characteristic extraction process (step S701). New features of the process may be detected and data fields may be increased. The data field may be reduced by recalculation of the feature quantity of the process.

In the configuration information update process (step S702), the management server 201 acquires configuration information of the computer system to be managed. For example, the management server 201 detects that the virtual machine has migrated and the operating server apparatus 203 has been changed, and updates the configuration information table 500 of the computer system included in the configuration information 233. Further, even if the application executes the same processing, if the processing characteristic changes with the increase of the data amount, the processing characteristic 604 of the configuration information table 600 of the application included in the configuration information 233 may be calculated again. In addition, when a new function is added along with the update of the application, a new data record may be added to the configuration information table 600 of the application included in the configuration information 233. Further, a change in the API specification may be detected as the cloud service 206 is updated, and the configuration information table 500 of the computer system included in the configuration information 233 may be updated. In addition, processing other than that illustrated as abnormal may be executed.

In the correlation analysis process (step S703), the management server 201 analyzes the correlation between the operation data of the managed computer system and the processing performance of the application having the feature amount of the processing characteristic 231, and updates the correlation data 232. . For example, when the IOPS to the logical volume of the storage apparatus 204 exceeds a predetermined value, when the response time of the processing group of the application corresponding to the ID 301 of the processing characteristic 231 corresponds to C2, the logic of the storage apparatus 204 increases. The increase in IOPS of the volume and the processing characteristic C2 are analyzed, and the information that the degree of correlation between the two is high is stored. The correlation analysis process may be performed manually or by another program. If a new correlation is not detected in the correlation analysis process (step S703), the correlation data 232 may not be updated. In the correlation analysis process (step S703), when there is not enough learning data to analyze the correlation corresponding to the data field of the correlation data 232, for example, the correlation data 232 is not shown in FIG. If the ST CPU field corresponding to the IO processing unit 262 of the storage device 204 has been added, as operation data 234 in an amount sufficient to analyze the correlation, if the operating data of the IO processing unit and the application program does not exist, The processing by another program may be executed by the computer system managed by the management server 201 to generate operation data sufficient for analysis of correlation, and the effect of the analysis processing of correlation (step S703) may be enhanced.

Next, the impact analysis process performed by the management server 201 will be described. The impact analysis process is a process implemented by the processor 211 of the management server 201 executing the impact analysis process program 221.

FIG. 8 is a flowchart illustrating an example of the procedure of the impact analysis process performed by the management server 201. The impact analysis process may be performed in accordance with an instruction from the administrator input from the input device 214 of the management server 201. Also, the influence analysis process may be executed by the management server 201 in response to an instruction from another program. Further, when the management server 201 receives, via the communication interface 216, the notification of the occurrence of a problem transmitted by the computer system managed by the management server 201, the management server 201 may execute the impact analysis process.

  As illustrated in FIG. 8, the management server 201 performs problem detection processing of the computer system (step S801), identification processing of related applications (step S802), impact analysis processing for each processing (step S803), and generation processing of measures (step S804) and the countermeasure execution process (step S805) are executed. The impact analysis processing flow 800 may include other processing steps not shown. In addition, some of the illustrated processing steps may not be performed.

In the problem detection process of the computer system (step S801), the management server 201 detects a problem occurring in the managed computer system. For example, the collected operation data of the computer system is compared with the threshold of the operation data, and when the operation data exceeds the threshold, the occurrence of a problem is detected. Also, for example, the text of the operation data of the computer system may be analyzed to detect that a problem has occurred when a specific character string such as “Error” or “Warning” is included. Further, for example, from increasing the operating data, when the operating data within a few days exceeds the threshold value is predicted, it may detect a sign of the problem. The problem detection process of the computer system may be executed by the event detection program 222. When a problem of the computer system is detected, information which can specify a record of the configuration information table 500 of the computer system of the configuration information 233 is output as a place where the problem occurs. For example, the information indicates that a problem has occurred in a logical volume whose name is LU2 in the storage apparatus 204 whose name is Storage1.

In the identification of the related application (step S802), the management server 201 identifies an application associated with the computer system in which the problem has occurred. Management server 201 of the computer configuration information table 500 in the system configuration information 233, the computer problem detection of app field 501 in the computer system problems detected at (step S801) corresponds to the field generated in the connection relationship Extract and output. For example, in the configuration information table 500 of the computer system illustrated in FIG. 5, the storage field 504 is the storage 1 and the logical volume field 505 corresponds to the LU 2 is the application A and the application B. Therefore, it can be understood that the applications related to the LU 2 problem existing in the storage 1 are the application A and the application B.

The outline | summary of specific process (step S802) of a related application is shown in FIG. As shown in FIG. 9, in the computer system managed by the management server, an application A, an application B, an application C, an application D, an application E, and an application F are operating . The application A, the application B, the application C, and the application D are operating on the server 1, and the application E and the application F are operating on the server 2. In addition, all of application A, application B, application C, application D, application E, and application F store data in storage 1, and application C stores communication I / F 1 in storage 1. The application A and the application D use the communication I / F 2 in the storage 1, the application B uses the communication I / F 3 in the storage 1, and the application E is in the storage 1. The communication I / F 4 is used, and the application F uses the communication I / F 5 in the storage 1. Further, the application C and the application D use the IO processing unit 1, and the application A, the application B, the application E and the application F use the IO processing unit 2. Also, application C and application D store data on logical volume LU1, application A and application B store data on logical volume LU2, and application E and application F store logical volume LU3. Data is stored on the top.

  The logical volume LU1 is configured by making the auxiliary storage device 1, the auxiliary storage device 2 and the auxiliary storage device 3 redundant, and the logical volume LU2 has the auxiliary storage device 4, the auxiliary storage device 5 and the auxiliary storage device 6 , And the logical volume LU3 is configured by making the auxiliary storage device 7, the auxiliary storage device 8 and the auxiliary storage device 9 redundant. As illustrated, the combination of components of the computer system to be used is different for each application. In the related application identification process (step S802), for example, when a problem occurs in the logical volume LU2, even in the application sharing the storage 1, the application C, the application D, the application E, and the application F communicate with the logical volume LU2. There is no relation, and the application A and the application B are processes for specifying that they are related to the logical volume LU2.

  In the impact analysis for each process (step S803), identification information for identifying the component of the computer system which has the problem output in the problem detection of the computer system (step S801) and identification of the related application (step S803) It receives as input the identification information for specifying the application affected by the problem of the computer system, which is the output of S802), and outputs the identification information for specifying the affected process among the affected applications.

  In the impact analysis process for each process (step S 803), the management server 201 refers to the correlation data of the field in the correlation data 232 that matches the component of the computer system in which the problem is occurring, and the process with a high degree of correlation. Calculate the processing characteristics that are affected by identifying the characteristics. When the degree of correlation is recorded as characters, it is preferable to determine whether the processing characteristics of characters showing a high degree of correlation match or when the degree of correlation is recorded as a numerical value. It is preferable to determine by comparing with a threshold, and when the degree of correlation is determined by an equation, it may be determined by whether the value calculated by the equation matches a predetermined condition.

Next, the management server 201 acquires a record in the application configuration information table 600 of the configuration information 233 that matches the application affected by the application field 602, and among the acquired records, the affected processing characteristics and processing The records matching the property field 604 are output as affected processes.

  For example, as illustrated in FIG. 10, when correlation data 232 is used, the component of the computer system in which the problem occurs is a logical volume of storage, and the field corresponding to the logical volume of storage is ST LU field 404 It can be determined that the processing characteristics C2 and C3 are affected processing characteristics. Then, with reference to the configuration information table 600 of the application, among the records corresponding to the application A and the application B, the record whose processing characteristic field 604 is C2 or C3 is the process with the ID F2 and the process with the ID F3. It is understood that there is an ID of the process concerned, and F2 and F3 are outputted.

In the countermeasure generation process (step S804), the management server 201 inputs the components of the computer system in which the problem is occurring, the affected application, and the processing characteristics, and outputs the countermeasure. The countermeasure generation process may be executed by the countermeasure generation program 224. For example, when information is input that the processing of the processing characteristics C2 and C3 of the application A and application B is affected due to IOPS of the logical volume LU2 of the storage 1 being a problem, the logical volume used by the application B is changed from LU2 Output the countermeasure to change to LU3. The countermeasure generation process (step S804) may be performed manually or by another program. When it is determined that there is no processing that has significant influence in the impact analysis processing (step S803) for each processing, the countermeasure generation processing (step S804) may not be executed. Also, the management server 201 may output the result of the processing up to here of the influence analysis processing flow 800 to the administrator via the input / output device 241 of the operation terminal 202. For example, the screen illustrated in FIG. 11 may be output.

  The screen illustrated in FIG. 11 is roughly classified into three pieces of information: a problem 1101, an influence 1102, and a measure 1103. The problem 1101 is information visualizing the output of the problem detection process (step S801) of the computer system. An influence 1102 is information obtained by visualizing the output of the related application identification process (step S802), the influence analysis process for each process (step S803), the output, and the process characteristic 231 in combination. The countermeasure 1103 is information visualizing the output of the countermeasure generation process (step S804). By referring to these pieces of information together, the administrator can easily understand the problem that has occurred, its impact, and the countermeasure plan for resolving the impact, and can judge which countermeasure plan should be implemented.

  However, these pieces of information may be displayed on separate screens of the problem 1101, the influence 1102, and the countermeasure 1103. Also, when some of these pieces of information are provided by another management server, some of the information may not be displayed. Furthermore, when the generated measures are automatically executed, all or part of the information may not be displayed.

  In the countermeasure execution process (step S805), the management server 201 receives the countermeasure output in the countermeasure generation (step S804) as an input, and outputs an instruction procedure to execute the countermeasure. For example, when a measure to change the logical volume used by application B from LU2 to LU3 is input, a command to change the logical volume storing data used by application B from LU2 to LU3 is output to the storage device 204 Do. This step may be performed manually or by another program.

  Further, the countermeasure execution process (step S805) may not be performed. For example, when the countermeasure generation process (step S804) is not executed, or when the administrator of the computer system refers to the output of the countermeasure generation process (step S804) and determines that the execution of the countermeasure is unnecessary, The countermeasure execution process (step S805) is not executed.

As described above, according to the first embodiment of the present invention, the management server 201 uses the operation data 234 of the computer system to be managed and the processing characteristics 231 of the application to be managed. When a problem occurs in a computer system to be generated and managed, the correlation data 232 and the configuration information 233 can be used to specify the processing of the affected application. Further, since the manager of the computer system can grasp the feature quantities of the affected process, it is possible to easily estimate the causal relationship between the problem occurring in the computer system and the influence thereof. Therefore, the administrator of the computer system can quickly consider and execute the necessary measures to maintain the performance of the application.

Example 2
FIG. 12 is a block diagram showing a configuration example of a system in the second embodiment of the present invention.

The main storage device 212 of the management server 201 of the second embodiment does not store the influence analysis processing program 221, but stores the cause analysis processing program 223. The other configurations and functions are the same as those of the first embodiment, so the same reference numerals are given and the description thereof is omitted.

Next, the cause analysis processing program of the management server 201 will be described. The cause analysis process is a process implemented by the processor 211 of the management server 201 executing the cause analysis processing program 223.

FIG. 13 is a flowchart illustrating an example of a procedure of cause analysis processing executed by the management server 201. The cause analysis process may be executed according to an instruction from the administrator input from the input device 214 of the management server 201. The cause analysis process may be executed by the management server 201 in response to an instruction from another program. Further, when the management server 201 receives, via the communication interface 216, the notification of the occurrence of a problem transmitted by the computer system that is a device managed by the management server 201, the cause analysis processing may be executed.

  As illustrated in FIG. 13, the management server 201 performs application problem detection processing (step S1301), processing for detecting correspondence with processing characteristics (step S1302), narrowing processing of cause range (step S1303), and calculation processing of cause location ( Step S1304) is executed. The cause analysis processing flow 1300 may include other processing steps not shown.

  In the application problem detection process (step S1301), the management server 201 detects a problem occurring in a specific process of the managed application program 250, and information that can specify an application program having a problem and its process. Output For example, a problem is detected in which the processing time for displaying the output screen of the end user of the application exceeds the threshold, and the application field 602 and the processing field 603 in the configuration information table 600 of the application included in the configuration information 233 are output. . The detection of a problem occurring in the application program may be executed by the event detection program 222 or may be manually executed by an administrator.

  In the processing of detecting correspondence with processing characteristics (step S1302), the management server 201 identifies the processing characteristics in which a problem has occurred. Specifically, the output of the application problem detection process (step S1301) is used as an input, and all the processing characteristic fields 604 of the corresponding application in the application configuration information table 600 included in the configuration information 233 are acquired and output. .

In the process of narrowing down the cause range (step S1303), the management server 201 outputs the candidate of the cause range of the problem occurring in the application program 250. For example, the management server 201 receives, as an input, the output of the process of detecting correspondence with processing characteristics (step S1302), and among the correlation data stored in each field of the correlation data 232, operation data of each component of the computer system and A data field stored as having a correlation with application performance (processing characteristics) is acquired as a candidate for the cause range. If there is no correlation in any combination of the input processing characteristic and the data string, the data field may be output as a candidate of the cause range.

In the process of calculating the cause (step S1304), the management server 201 includes the application field 501 of the configuration information table 500 of the computer system included in the configuration information 233 and the application field output in the problem detection processing of the application (step S1301). The configuration of the computer system described in the data record of the configuration information table 500 that matches 602 and in the acquired data record, the data record that matches the data field acquired in the narrowing process of the cause range (step S1303) Output the element as a candidate for the cause. When multiple components are output as candidate causes, they may be prioritized and output. For example, when a plurality of components are calculated as candidate causes, the operation data 234 of the corresponding component is referred to, and the tendency different from the normal behavior (for example, the CPU usage rate is 30% higher than normal), When the number of database access logs is recorded more than a threshold value), it may be preferentially output as a candidate for the cause.

As described above, according to the second embodiment of the present invention, the management server 201 generates correlation data 232 using the operation data 234 of the managed computer system and the processing characteristic 231 of the managed application. When a problem occurs in the managed application program, the correlation data 232 and the configuration information 233 are used to specify the component of the computer system that is the cause. Therefore, the administrator of the computer system can quickly consider and execute the necessary measures to maintain the performance of the application.

As described above, according to the embodiment of the present invention, the management server 201 extracts the characteristic of the process included in the application program, and analyzes the correlation between the characteristic of the process and the component of the computer system to obtain the application program. The correlation between the process included in the computer system and the component of the computer system is specified to generate correlation data 232, and based on the correlation data 232, the relationship between the operation status of the computer system and the characteristic of the process included in the application program is specified. Therefore, the unit of processing included in the application program can determine the range affected by the abnormality that has occurred in the computer system.

  Also, when the management server 201 detects a configuration change of the computer system (for example, change of hardware, migration of virtual computer, change of disk of storage, etc.), extraction of processing characteristics and characteristics of processing and the computer system The accuracy of the correlation data 232 can be improved by learning, since at least one of the analysis of the correlation with the component of H is performed. In particular, the correlation data update can follow the configuration change frequently performed in the cloud configuration.

  Also, when the management server 201 detects a change in application program usage tendency (for example, an increase in the number of users, addition of application program functions, etc.), extraction of processing characteristics, processing characteristics, and processing characteristics of the computer system Since at least one of the analysis of the correlation with the component is performed, the accuracy of the correlation data 232 can be improved by learning. In particular, the correlation data update can follow the configuration change frequently performed in the cloud configuration. For example, the addition of the function of the application program adds a new process not included in the processing characteristic 231, causes a correlation with other processing characteristics, or adds a new processing characteristic not included in the processing characteristic 231, The correlation between the characteristics and the components of the computer system may be recorded.

  In addition, when the management server 201 detects an abnormality or a sign of abnormality of the computer system, the management server 201 specifies the processing of the application program affected by the abnormality based on the correlation data 232. It can be specified in units, and measures on the application side can be made. In addition, it is possible to take measures on the application side (before the occurrence of an abnormality) at the omen stage of the abnormality.

  In addition, since the management server 201 outputs screen data for displaying a computer system abnormality or a symptom of an abnormality and processing of an application program affected by the abnormality, the influence caused by the abnormality can be known for each processing. In addition, since the tendency of processing affected by abnormality of the computer system is known, it is possible to jointly carry out measures on the computer system side (such as addition of a disk) and measures on the application side (such as access restriction). Also, information for modifying the application program can be obtained.

  Further, when the management server 201 detects a problem in the application program, it identifies the component of the computer system that is the cause of the problem based on the correlation data 232. Can be identified. This facilitates maintenance on the computer system side.

  The present invention is not limited to the embodiments described above, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the embodiments described above are described in detail to explain the present invention in an easy-to-understand manner, and the present invention is not necessarily limited to those having all the configurations described. Also, part of the configuration of one embodiment may be replaced with the configuration of another embodiment. In addition, the configuration of another embodiment may be added to the configuration of one embodiment. In addition, with respect to a part of the configuration of each embodiment, another configuration may be added, deleted, or replaced.

  In addition, each configuration, function, processing unit, processing means, etc. described above may be realized by hardware, for example, by designing part or all of them with an integrated circuit, etc., and the processor realizes the respective functions. It may be realized by software by interpreting and executing the program to

  Information such as a program, a table, and a file for realizing each function can be stored in a memory, a hard disk, a storage device such as a solid state drive (SSD), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, control lines and information lines indicate what is considered to be necessary for explanation, and not all control lines and information lines necessary for mounting are shown. In practice, it can be considered that almost all configurations are mutually connected.

Claims (15)

A management server connected to a computer system that executes an application program,
A processor for executing a program, and a storage device for storing the program;
The processor extracts the characteristic of the process included in the application program, and the process included in the application program and the component of the computer system by analyzing the correlation between the characteristic of the process and the component of the computer system Identify the correlation of
A management server, characterized in that the processor specifies a relation between an operation status of the computer system and a characteristic of a process included in the application program based on the specified correlation. The management server according to claim 1, wherein
When the processor detects a configuration change of the computer system, the processor executes at least one of extraction of the characteristic of the process and analysis of correlation between the characteristic of the process and a component of the computer system. Management server The management server according to claim 1, wherein
The processor executes at least one of extraction of the characteristic of the process and analysis of correlation between the characteristic of the process and a component of the computer system when detecting a change in the usage tendency of the application program. Management server to feature. The management server according to claim 1, wherein
A management server, characterized in that, when the processor detects an abnormality of the computer system or a sign of an abnormality, processing of an application program affected by the abnormality is specified based on the specified correlation. The management server according to claim 4, wherein
A management server characterized in that the processor outputs screen data for displaying an abnormality or a sign of an abnormality of the computer system and processing of an application program affected by the abnormality. The management server according to claim 1, wherein
A management server, characterized in that, when the processor detects a problem in the application program, the processor identifies a component of the computer system that is the cause of the problem based on the identified correlation. A management method in which a management server manages a computer system that executes an application program,
The management server includes a processor that executes a program, and a storage device that stores the program.
The management method is
The processor extracts the characteristic of the process included in the application program, and the process included in the application program and the component of the computer system by analyzing the correlation between the characteristic of the process and the component of the computer system Identifying the correlation of
A management method comprising: the processor identifying a relationship between an operation status of the computer system and a characteristic of a process included in the application program based on the identified correlation. The management method according to claim 7, wherein
When the processor detects a configuration change of the computer system, the processor executes at least one of extraction of the characteristic of the process and analysis of correlation between the characteristic of the process and a component of the computer system. Management method. The management method according to claim 7, wherein
The processor executes at least one of extraction of the characteristic of the process and analysis of correlation between the characteristic of the process and a component of the computer system when detecting a change in the usage tendency of the application program. Management method to feature. The management method according to claim 7, wherein
The management method according to claim 1, wherein the processor specifies processing of an application program affected by the abnormality based on the identified correlation when detecting a sign of abnormality or abnormality of the computer system. The management method according to claim 10, wherein
A management method comprising: outputting, by the processor, screen data for displaying an abnormality or a sign of an abnormality of the computer system and processing of an application program affected by the abnormality. The management method according to claim 7, wherein
A management method comprising: when the processor detects a problem in the application program, identifying a component of the computer system that is the cause of the problem based on the identified correlation. A program for a management server to manage a computer system that executes an application program,
The management server has a processor that executes the program, and a storage device that stores the program.
The program is
The characteristic of the process included in the application program is extracted, and the correlation between the process included in the application program and the component of the computer system is specified by analyzing the correlation between the characteristic of the process and the component of the computer system And the steps to
A program for causing the processor to execute a procedure for specifying the relationship between the operation status of the computer system and the characteristic of the process included in the application program based on the identified correlation. The program according to claim 13, wherein
A program for causing the processor to execute a procedure of specifying processing of an application program affected by the abnormality based on the identified correlation when detecting a sign of abnormality or abnormality of the computer system. The program according to claim 13, wherein
A program for causing the processor to execute a procedure for identifying a component of the computer system that is the cause of the problem based on the identified correlation when a problem with the application program is detected.